Runtime C# compilation is the process of compiling C# code while a program is already running, rather than building it ahead of time into a normal executable. Attackers use this to generate helper code on the fly, adapt behavior to the host, or load functionality only when needed. Because the C# source or intermediate code may exist only briefly in memory, it can leave fewer obvious on-disk artifacts than a traditional dropped binary.
In cyber security, this matters because it can help malware blend in with legitimate automation and make file-based detection less effective. It is often seen in loaders, backdoors, and post-exploitation tooling that want to keep their payload flexible. Defenders look for unusual use of .NET compilation APIs, suspicious script or PowerShell processes invoking C# compilation, and memory-resident code generation. When runtime compilation appears alongside persistence or command execution, it can indicate a deliberate attempt to hide malicious logic behind normal Windows and .NET activity.